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ABSTRACT 

NASA is developing launch vehicles to support missions to Low Earth Orbit (LEO), the moon and deep 
space. Whether manned or unmanned, the vehicle components will likely be integrated in the Vehicle 
Assembly Building (VAB) at Kennedy Space Center (KSC) and typically include a fueled spacecraft (SC) 
that sits on top of one or more stages. The processing of a fueled SC involves hazardous operations 
when it is brought into the VAB Transfer Aisle and lifted a significant height for mating with lower stages. 
Accidents resulting from these hazardous operations could impact unrelated personnel working in 
buildings adjacent to the VAB. 

Safe separation distances based on the DOD Explosives Standards Quantity-Distance (Q-D) approach 
result in large IBD arcs. This paper presents site-specific air blast and fragmentation hazard analyses for 
comparison with the Q-D arcs as well as consequence and risk analyses to provide added information for 
the decision maker. A new physics-based fragmentation model is presented that includes: a) the 
development of a primary fragment list (which defines the fragment characteristics) associated with a 
hypergolic propellant explosion, b) a description of a 3D fragment bounce model, c) the results of 
probabilistic Monte-Carlo simulations (that include uncertainties in the fragment characteristics) to 
determine: i) the hazardous fragment density distance, ii) the expected number of wall/roof impacts and 
penetrations to over 40 buildings adjacent to the VAB, and iii) the risk to building occupants. 

PROBLEM DESCRIPTION 

NASA future plans may involve integration of launch vehicle components inside the high bays of the 
Vehicle Assembly Building (VAB) at Kennedy Space Center (KSC). An integration process typically 
involves several hazardous operations including the movement of a fueled spacecraft (SC) into the 
Transfer Aisle (TA) outside a high bay and then lifting the SC to a significant height for mating with the 
vehicle’s lower stages. NASA is concerned with the hazards and risks to occupants of numerous 
buildings adjacent to the VAB (unrelated to the hazardous operations) if an explosion accident should 
occur in the TA or during mating operations. To assess the potential explosion effects, both air blast and 
fragmentation analyses were performed using an existing Orion and Service Module spacecraft design 
which is representative of a typical manned exploration SC. 

During integration to the existing ARES-I launch vehicle design 1 , a fueled Orion SC would be transported 
into the VAB transfer aisle, lifted up over 300 feet, and placed on top of a 2 nd LOX/LH2 second stage 
which is mounted on a five segment 1 st stage solid rocket motor stack (1 st stage). The SC consists of a 
payload adapter, service module, crew capsule and launch abort system as shown in Figure 1 . 


1 The ARES I program was originally designed to replace the Space Shuttle's capability for taking astronauts to the 
International Space Station (ISS) as well as a re-supply capability but the program was recently cancelled. 
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Figure 1. Orion SC Positioned at Top of ARES-1 Vehicle. 


The ARES-I first stage is a single, five-segment reusable solid rocket booster derived from the Space 
Shuttle Program’s reusable solid rocket motor. The ARES I second stage is propelled by a J-2X main 
engine fueled by liquid oxygen and liquid hydrogen. The Orion Crew Exploration Vehicle (CEV) 
sandwiched between the Service Module (SM) and Launch Abort System (LAS) is similar in shape to the 
Apollo capsule, but significantly larger. The launch abort system atop the Orion capsule is capable of 
pulling the spacecraft and its crew to safety in the event of an emergency on the launch pad or at any 
time during ascent. Orion’s power and propulsion systems are housed in the SM which is mounted 
directly below the capsule (see Figure 2). The propulsion system consists of a Delta II upper stage 
engine using nitrogen tetroxide and monomethyl hydrazine hypergolic propellants which are considered 
Hazard Division 1.1. 



The ARES-I (or other typical NASA launch vehicles) will likely be assembled in one of several VAB high 
bays. The locations of potential SC explosions were assumed to occur while the fueled SC is processed 
at ground level in the Transfer Aisle (TA) outside of a high bay or being mated to the lower stages at 
approximately 322 feet above ground level as shown in Figure 3. 
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Figure 3. Location of Explosion Locations Considered. 

EXPLOSION EVALUATION PROCESS 

Figure 4 shows the four step process that the DOD Explosives Safety Board (DDESB) recommends for 
evaluating explosive hazards, consequences and risk in order to gain an explosives site plan approval. 
Note that all four steps do not have to be performed for approval; meeting the acceptance criteria for any 
of the four steps is sufficient. For example, if the explosives site plan is in conformance with the DOD 
Quantity-Distance (Q-D) criteria the other three steps need not be performed. Similarly if the risk is 
shown to be acceptable it can be used to gain approval even if Q-D safe separation distances are 
violated. 
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It is insightful, however, to perform all four steps as each one provides the decision-maker with additional 
information that is helpful in understanding both hazards and risks when making explosives siting 
decisions (such as implementing potentially costly mitigations). The following sections present the 
analysis results for each step considering the four SC hypergolic propellant explosion scenarios that 
could occur in the VAB. 

QUANTITY-DISTANCE ANALYSIS 

The Quantity-Distance safe separation distances were determined using the “DOD Ammunition and 
Explosives Safety Standards”, DOD 6055.9-STD, Reference [1] which is the parent explosives safety 
standard document used by the services. NASA-STD-8719.12, Safety Standard for Explosives, 
Propellants, and Pyrotechnics”, Reference [2], is NASA’s equivalent standard based on the parent 
document and gives the same separation distances for the accident events examined in this study. To 
determine the Q-D separation distances, the Net Explosion Weight (NEW) of the accident must be 
defined. Based on DOD 6055.9-STD, the yield factor for hypergolic propellant is 5% for static accidents 
and 10% for dynamic accidents. 2 NASA requested that the conservative yield factor of 10% be used for 
all VAB explosion accident simulations even though relevant test data indicates much lower yield factors. 
The total amount of hypergolic propellant stored in the Orion spacecraft is 18,545 lbs; therefore, the NEW 
is 0.10 x 18,545 = 1,855 lbs, TNT. 

Based on the 1,855 lb NEW, the Inhabited Building Distances (IBD’s), that are used to protect personnel 
unrelated to a hazardous operation, were determined for air blast and fragmentation. The IBD distance 
for air blast is the distance at which the incident overpressure from the explosion drops below 1 .2 psi. 

For fragment throw, the IBD is based on limiting the hazardous fragment 3 density to less than one per 
600 square feet. For a NEW of 1,855 lb, fragmentation hazards control and the IBD distance is 1250 feet 
(see Figure 5). As can be seen, the fragmentation IBD encroaches on numerous existing occupied 
buildings adjacent to the VAB. 

EQUIVALENT PROTECTION ANALYSIS 

If Q-D safe separation distances impact proposed operations, the DDESB explosives site plan process 
allows the requesting organization to perform site-specific equivalent protection analyses. Site-specific 
equivalent protection analyses are used to determine if the IBD distance(s) based on the DOD Explosives 
Standard are overly conservative. ACTA performed both air blast and fragmentation equivalent 
protection analyses; they indicated that fragment throw does control over air blast. The fragment 
equivalent protection analyses involved the development of an Orion spacecraft-specific primary fragment 
list and incorporating a secondary debris list (which defines debris thrown from the VAB internal structure 
and exterior walls) based on work done by Engineering Analysis Inc. (EAI), References [4] and [5]. 

AIR BLAST ANALYSIS 

The equivalent air blast safe separation distance was based on determining the distance at which the 
incident overpressure drops below 1.2 psi (the IBD level). To determine the overpressure and impulse as 
a function of distance, a Transfer Aisle explosion (the controlling case) was modeled as a detonation 
resulting from a ground level hemispherical charge (see Figure 6). Again, it was conservatively assumed 
that the VAB internal and external structure would not attenuate the blast wave. ERDC’s CONWEP 
program [3] was used to predict the overpressure and impulse as a function of distance. The table shown 
in Figure 6 summarizes the incident and reflected overpressure and impulse. As Figure 6 and Figure 7 
show, the IBD distance based on our analysis indicates a safe separation distance for air blast of 483 feet 
from the center of the explosion and is much less than the 1250 foot IBD fragmentation distance. 

FRAGMENTATION ANALYSIS 

The fragment equivalent protection analyses involved the development of a spacecraft-specific primary 
fragment list and incorporating a secondary debris list (which defines debris thrown from the VAB internal 
structure and exterior walls) based on work done by Engineering Analysis Inc. (EAI). The following 
subsections describe the development of the primary fragment and secondary debris lists. 


2 A static accident is associated with controlled engine testing and a dynamic accident with launch operations. 

3 The DOD explosives standard considers a hazardous fragment as one having a KE of 58 ft-lbs or greater. 



Figure 5. Q-D Explosives Standard Q-D Fragmentation Arc. 
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Figure 6. Overpressure and Impulse as a Function of Distance (explosion at 322 feet). 
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Figure 7. Transfer Aisle Explosions - IBD (1.2 psi) and 0.5 psi Contours. 

Primary Fragment List 

The primary fragment list was developed to represent primary fragmentation thrown as the result of a 
hypergolic propellant detonation inside the service module of the Orion spacecraft. Spacecraft hardware 
components, locations, weights and shapes were determined based on dimensional drawings, detailed 
material lists and photographs ( see Figure 8). Based on these data, over 20,000 fragments were 
included in the fragment breakup list. The list includes intact components such avionics packages, 
batteries and other bolted down packages as well as distributed fragments representing the breakup of 
the spacecraft exterior shell, panels and cabling. A modified Gurney method was used to estimate 
fragment initial velocities. Reference [4] provides details of the primary fragment list development 
procedures. 



♦ 





Figure 8. Samples of Spacecraft Hardware. 
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Secondary, Debris Ust 

The secondary debris list representing the debris thrown as a result of the breakup of work platforms and 
interior/exterior VAB walls and structure was developed by Engineering Analysis Inc. (EAI). EAI 
determined the air blast loading along discrete ray paths as shown in Figure 9 and determined the 
potential failure of both internal structures and external wall cladding. Structural failures and residual air 
blast loading were used to determine the secondary debris list and the associated initial velocities. 
Reference [5] provides details on the EAI secondary debris list development procedure. 

HAZARDOUS FRAGMENT DENSITY DISTANCE 

The fragmentation analyses were carried out using DebrisHAZ, a program developed at ACTA to perform 
detailed, site- and vehicle-specific explosion fragment hazard simulations. The combined primary 
fragment and secondary debris list included hundreds of fragment groups (and thousands of individual 
fragments) with different nominal weights, ballistic coefficients, velocities, takeoff angles, etc. Thousands 
of random drag-corrected trajectory simulations were run including the consideration of bounce and roll to 
account for uncertainty in the fragment parameters. A new 3D physics-based bounce/roll model was 
used to predict each fragment's path after first impact based on its shape and ground contact 
characteristics (see Figure 10); details of the bounce model are presented in a companion paper [6], 

The results of the random fragment/debris throw simulations were averaged to determine the hazardous 
fragment density distance (HFDD) based on the pseudo-trajectory normal method of recording hazardous 
fragment effects. Figure 1 1 shows the envelope of the HFDD’s from all four explosion scenarios. The 
maximum HFDD distance is approximately 900 feet (controlled by EAl’s secondary debris list in the 
northeast and southwest directions). The HFDD based on primary fragments is limited to approximately 
500 feet (see Figure 12). The HFFD’s of 500 or 900 feet based on the equivalent protection analysis are 
much less than the 1250 foot fragment HFFD specified by the Explosives Standards. 



FIGURE 43. CASE #1 
PATHS AND PERIMETER POINTS ON 26th LEVEL OF VAB 

Figure 9. EAl’s Secondary Debris Path Schematic - High Bay 3 at 322 feet. 
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Figure 10. Sample of 3D Physics-Based Fragment Bounce Model. 



Figure 11. Envelop of Fragmentation Hazardous Fragment Density Distance (All Four Scenarios). 
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Figure 12. HFDD Based Only on Primary Fragment Throw from High Bay 3 at 322 feet. 

CONSEQUENCE ANALYSIS 

The Q-D and equivalent protection analyses are used to determine the “hazards” (air blast overpressure 
and hazardous fragment density); they do not consider the associated consequences in terms of damage 
to structures, window breakage and injury to people given an explosion occurs. It is well known that the 
air blast IBD (1.2 psi incident overpressure) will prevent significant damage to conventionally built 
structures beyond IBD; however, window breakage can occur at distances well beyond IBD and structural 
damage and window breakage could occur inside IBD and potentially hazard existing building occupants. 

Air blast and fragment throw consequence analyses were performed using ACTA’s HAZX and DebrisHAZ 
explosion assessment software. To perform these analyses, the locations and attributes of buildings 
adjacent to the VAB within a 7,000 foot radius were entered. The necessary building data were obtained 
from the Air Force 45SW/SELR and included wall/roof construction types, window types/sizes/numbers 
and maximum population counts. 

These data were input into HAZX and a hypergolic propellant explosion of 1855 lb, TNT was simulated to 
determine the injury to people in the open, structural damage, window breakage and injury to building 
occupants due to air blast. Figure 13 shows the areas adjacent to the VAB where people in the open 
could be injured due to air blast. At distances beyond about 400 feet (the nearest wall of the Launch 
Control Center, LCC) people in the open will suffer at most temporary loss of hearing and ear drum 
ringing. 4 

Structural damage due to air blast given a hypergolic propellant explosion occurs is shown in Figure 14. 
As expected, little damage will occur outside of IBD 5 for buildings of conventional construction and the 
only building inside of IBD that could be damaged is part of the VAB (the LCC has a blast resistant 
design). Figure 15 and Figure 16 show the expected window breakage and the expected number of 
casualties resulting from glass shards being thrown into buildings. Based on the window inventory 
received from the 45SW/SELR, there is a high likelihood that several existing buildings adjacent to the 
VAB will incur window breakage and glass shards thrown inward could cause serious injuries to 
occupants. 


4 People can withstand greater blast overpressure levels than weaker buildings as the body is compliant and can 
absorb energy. 

5 IBD is established to prevent damage to structures that could hazard occupants. But, the Explosives Standards 
note that window breakage could be an issue and buildings with windows facing the explosion should be avoided. 
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Figure 13. Injury to People in the Open. 
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Figure 14. Structural Damage due to Air Blast. 


14 






Figure 16. Expected Number of Serious Injuries or Greater due to Air Blast. 


The consequences to occupied buildings adjacent to the VAB due to fragmentation were determined by 
recording the potential fragment impacts and penetrations of each building’s walls and roof. To 
accomplish this, the footprints of the occupied buildings were extruded upward to their respective heights 
(as shown in Figure 17) and fragment penetration energies assigned to the walls and roof of each 
building based on their construction characteristics. Thousands of random simulations of primary and 
secondary fragment/debris throw (using the lists previously described) were performed and the number of 
wall/roof impacts and penetrations recorded for each simulation (Figure 18 shows one such simulation). 
The impacts and penetrations were averaged across all simulations to determine the expected number of 
impacts and penetrations. 

The results of the fragment consequence analysis indicated people in the open and numerous buildings 
adjacent to the VAB could be impacted by fragments; however, only three buildings would likely suffer 
roof penetration due to their light construction and potentially hazard occupants. 
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Figure 17. Buildings Included in the Fragment Consequence Analysis. 



Figure 18. One Random Simulation of Fragment Throw. 
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RISK ANALYSIS 

The previous analyses did not take into account the probability that a spacecraft handling or processing 
accident could result in a hypergolic propellant explosion. As part of this study, ACTA estimated the 
probability of a spacecraft handling/processing accident and performed simplified quantitative risk 
analyses (QRA’s) to determine if the risk to people working adjacent to the VAB (but unrelated to 
hazardous operations in the VAB) were acceptable. 

The probability of a handling or processing accident involving the fueled spacecraft inside the VAB was 
conservatively estimated based on historical operations/accidents recorded at VAFB, CCAFS and KSC 
over the last several decades. The per mission accident probability was estimated to be 1 .4x1 O' 3 . 

Since NASA has not adopted acceptable risk criteria for pre-launch operations, two current criteria were 
considered: 

1. Range Commander Council’s Flight Safety Guidance (RCC 327-01), Reference [7] - they 
recommend that the following three risk metrics be considered: a) maximum individual casualty 
and fatality risk per mission, b) group casualty and fatality risk per mission, and c) annual 
casualty and fatality group risk. 

2. DDESB Conventional Weapons Criteria - they currently recommend that only the maximum 
individual and group fatality risk on an annual basis be considered. 

The controlling acceptable risk metric for the explosion of a fueled spacecraft inside the VAB is the RCC’s 
per mission metric for maximum individual and group casualty risk. Table 1 shows the computed 
casualty risks based on ACTA’s QFtA analyses compared to the RCC acceptable risk levels for unrelated 
personnel. 


Table 1. Risk Acceptability (unrelated) based on RCC per Operation Casualty Requirements. 


Risk Metric 

Vulnerability 

Computed Risk 

RCC Acceptable 
Casualty Risk 
(unrelated) 

w/ windows & 
fragments 

fragments 

only 

Maximum 

Individual 

Casualty 

110 xIO' 6 
(Bldg 0894) 

0.17 x 10' 6 
(Bldg 0696) 

1 x 10' 6 

Group 

Casualty 

28,000x1 O' 6 

79 x 1 0' 6 

100 xIO' 6 


The casualty risk is dominated by window breakage for several buildings inside of IBD. When window 
effects are eliminated from these buildings (e.g., by adding blast film), fragment impact hazards dominate 
and the risk becomes acceptable. 

Table 2 shows the computed fatality risks based on ACTA’s QRA analyses compared to the DDESB’s 
acceptance criteria for unrelated personnel. Because the DDESB does not consider casualties due to 
window breakage, the computed risks are acceptable and no mitigations are required to the existing 
buildings adjacent to the VAB. 

Table 2. Risk Acceptability (unrelated) based on DDESB Fatality Requirements. 


Risk 

Metric 

Computed 
Fatality Risk 
(fragments only) 

DDESB Acceptable 
Fatality Risk 
(per year) 

Maximum 

Individual 

4.7 x 10*® 
(Bldg 0894) 

1 x 10- 6 

Group 

4.8 x 10" 6 

1 x 10' 5 
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CONCLUSIONS 


This paper summarizes a study performed to evaluate the explosion hazards, consequences and risk to 
personnel in the open and located in existing buildings adjacent to the VAB due to the processing of a 
fueled spacecraft inside the VAB. Four explosion analyses were performed: 

1. Quantity-Distance (Q-D) - based on the DOD Explosives Standard, the Inhabited Building 
Distance (IBD) to protect people unrelated to hazardous operations inside the VAB was 
determined to be 1250 feet (based on fragmentation). 

2. Equivalent Protection - based on site-specific and accident-specific hazard analyses, the IBD 
fragmentation distance controls; it is approximately 500 feet for primary fragmentation (based 
on ACTA’s fragment list) and 900 feet for secondary debris (based on EAl’s debris list). 

3. Consequences - based on site-specific and accident-specific damage and injury analyses, air 
blast resulting from a hypergolic propellant explosion in the VAB could break windows of several 
buildings inside of IBD and inward flying shards could injury occupants. Inside of IBD, 
fragments will also pose a hazard to people in the open and to occupants of several adjacent 
buildings (note that low-flying fragments that can penetrate windows were not considered). 
Outside of IBD, building occupants and people in the open adjacent to those building are very 
unlikely to be hazarded by thrown fragments. 

4. Risks - simplified casualty and fatality risk analyses that included the probability of a hypergolic 
propellant explosion occurring inside the VAB produced different conclusions. If the RCC 
recommendations for risk acceptability are used (which include the consideration of casualties), 
the risks are unacceptable. If the DDESB recommendations for risk acceptability are used 
(which are based strictly on annual fatality), the risks are acceptable. 

The four-pronged explosion analysis approach provides valuable insights into the potential problems that 
could occur during handling and processing of a fueled spacecraft inside the VAB. Windows on several 
buildings adjacent to the VAB are likely to be broken due to air blast; therefore mitigations to prevent 
injuries to building occupants by installing blast film and/or by moving people in the building perimeter 
away from windows facing the VAB are being considered. Several buildings are also susceptible to 
fragment impact and penetration inside IBD and NASA is considering mitigations to minimize the risk. 
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Explosives Safety Analysis Process 
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overly conservative based on an vehicle-specific equivalent 

protection 

- Consequence analyses indicated that several buildings inside 
IBD could be hazarded by window breakage and fragment 
penetration given the accident occurs 

- Simplified risk analyses showed that acceptability was a 
function of the acceptable risk criteria 


Performing all four steps of the process provides valuable 
insights to help a decision-maker understand all the _ 
hazards/risks and determine best mitigation strategy " 
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